Get into the inbox
Whether your email reaches the inbox depends mostly on how people react to it. Mail only people who asked, keep spam complaints under 1 in 1,000, make leaving effortless, keep the list clean, stop mailing people who never respond, and send from a domain that's properly set up.
Whether an email reaches the inbox depends mostly on how the people who get it react. Mail people who asked, send what they expect, and make leaving effortless. The rest is housekeeping.
The short version
- Spam complaints decide everything. Keep them under 0.1%, one in every 1,000 emails. Gmail and Yahoo draw the hard line at 0.3%.
- Mail only people who asked. Never a bought, rented or scraped list.
- Make leaving effortless: a visible unsubscribe link, and the one-click unsubscribe Gmail and Yahoo require, honoured within two days.
- Keep the list clean: hard bounces under 2%, and every old or imported list checked before its first send.
- Stop mailing people who never respond, after a win-back, at 6 to 12 months without a click, a reply or a purchase.
- Send from a domain that's set up: SPF, DKIM and an aligned DMARC. Never from a free Gmail, Yahoo or Outlook address.
- Reputation is earned by steady sending, not by tricks. The words in an email matter far less than how people react to it.
- The Promotions tab isn't spam. It's part of the inbox.
The rules since 2024
Gmail and Yahoo set joint rules for senders of bulk mail from February 2024, and Microsoft followed for Outlook, Hotmail and Live in May 2025. They overlap almost completely:
| Gmail | Yahoo | Microsoft | |
|---|---|---|---|
| Who | Every sender; more rules from about 5,000 a day to personal Gmail | Every sender; more rules for bulk senders | Over 5,000 a day to Outlook, Hotmail and Live |
| SPF and DKIM | Both, for bulk senders | Both, for bulk senders | Both must pass |
| DMARC | Published and aligned, for bulk senders | Published and aligned, for bulk senders | Published and aligned |
| One-click unsubscribe | Required for marketing | Required | A working unsubscribe |
| Unsubscribes honoured | Within 48 hours | Within 2 days | |
| Spam rate | Under 0.10%, never 0.30% | Under 0.3% |
- Google counts all mail from one domain together, and a sender who crosses 5,000 in a day once is treated as a bulk sender for good.
- Gmail has been rejecting mail that breaks the rules since November 2025, and since June 2024 it won't help a bulk sender whose spam rate is over 0.3%.
- Microsoft rejects mail that fails, with the error "550; 5.7.515 Access denied".
Complaints: the number that decides
Every authority puts the line in the same place:
- Google: under 0.10%, never 0.30% or more, worked out daily.
- Yahoo: under 0.3%.
- Amazon SES: an account goes under review at 0.1%, and sending may be paused at 0.5%.
- Validity, 2026 report: the average was 0.06%, and "under 0.1 percent is now the expectation".
0.1% is one complaint per 1,000 emails. A business that sends 5,000 emails and gets 6 complaints is over it.
Complaints come from people who don't remember signing up, people who get more than they expected, and people who can't find the way out. So:
- Permission and a clear promise at sign-up: Build your email list.
- A rhythm you keep, the one the sign-up promised: How often to send.
- Emails that fit the person: The right email for the right people.
- A way out that's easy to find, in the footer and as the mail app's own Unsubscribe button.
- A from name they recognise, and a line reminding them how they signed up.
Unsubscribing
- The one-click unsubscribe (the internet standard RFC 8058, 2017) lets the mail app show its own Unsubscribe button, and it must work without a login.
- The visible link in the footer is still required by law in every market: Email marketing and the law.
- Honour it fast: within 48 hours for Google, 2 days for Yahoo, well inside the legal limits.
- Every unsubscribe that doesn't happen becomes a complaint later.
Prove the mail is yours
- SPF lists the servers allowed to send for your domain. One record per domain, and at most 10 DNS lookups: every service you add, a CRM, a help desk, a shop, adds to the count.
- DKIM signs every message, with a key of 2,048 bits.
- DMARC tells mailbox providers what to do with mail that fails. Start at p=none and read the reports, then move to quarantine and reject once every real sender passes. In 2026 DMARC became a full internet standard (RFC 9989), and records written for the old version still work.
- Alignment is the part people miss. SPF and DKIM can both pass for the sending service's own domain and still fail DMARC for yours. The domain in your From address must match the one that passed.
- Never send bulk mail from a free address, a personal Gmail, Yahoo or Outlook one. Those domains authorise nobody else's servers to send for them.
- A logo in the inbox (BIMI) needs DMARC enforced at quarantine or reject, and a certificate: a Verified Mark Certificate for a registered trademark, or a Common Mark Certificate. It helps readers trust the email; it isn't needed to get delivered.
Reputation
Mailbox providers judge a sender mainly by how people react: opening, replying, moving an email out of spam, deleting without reading, and complaining. Validity's 2026 report calls engagement "a primary trust signal". Google tells senders to grow their volume slowly, send at a consistent rate and avoid bursts. A new domain that sends thousands of emails on its first day looks like a spammer, because that's what spammers do.
Separate what's different. Receipts and password resets usually go from a different domain or subdomain than marketing, so a marketing problem never blocks a receipt. Google asks that messages of the same kind come from the same From address.
Never spread mail to hide. Spreading mail across many short-lived domains and addresses to dodge filters is a spammer's trick, called snowshoeing. A business with a reputation problem fixes its list and its sending; it doesn't buy new domains.
One sender's bad list hurts everyone who shares the sending. Providers judge the sending service as well as the sender, which is why a shared service refuses bought lists for every customer.
Keep the list clean
- Hard bounces: aim for under 2%. Amazon SES reviews an account at 5% and may pause it at 10%.
- Addresses die. Yahoo closes accounts after 12 months unused, Gmail after 24, so older lists bounce more.
- Check before a first send any list that's old, imported or of unknown origin, and check new addresses at the form.
- Suppress for good hard bounces, complaints and unsubscribes. Never upload them again.
- Shared inboxes such as info@ and sales@ often complain. Treat them with care.
Spam traps show how a list was built. Spamhaus describes three kinds:
| Trap | What it is | What hitting one means |
|---|---|---|
| Pristine | An address never used by a person | The list was bought or scraped |
| Recycled | A dead address a provider turned back on, often after 12 months or more | You kept mailing people who'd gone |
| Typo | An address at a misspelt domain | The form took unchecked typing |
Traps are never revealed, and removing one fixes nothing: the list that held it holds others.
Stop mailing people who never respond
Spamhaus puts the point at "anywhere from three to twelve months" without engagement, and Google's own words are: "Consider unsubscribing recipients who don't open or read your messages." Try to win them back first, over at least two months: Carts, win-backs, events and receipts. Since Apple's privacy changes, opens overstate who's reading, so judge by clicks, replies and purchases.
| Measure | Aim for | Warning | Serious |
|---|---|---|---|
| Spam complaints | Under 0.1% | 0.1% | 0.3% at Gmail and Yahoo |
| Hard bounces | Under 2% | 5% | 10% |
| Unsubscribes honoured | The same day | 48 hours | 2 days |
| Silence before you stop | A click, reply or purchase within 3 to 6 months | 6 to 12 months | Over 12 months |
A rule of thumb: stop after 6 months of silence if you send weekly, and 12 months at most if you send monthly.
What the email itself does
Filters judge the sender first. The content counts where it signals deception or risk:
- links or pictures on domains that are on a blocklist;
- a sender name that doesn't match the brand in the email;
- an email that doesn't make it obvious who sent it;
- an email that suggests the reader never asked for it.
Words such as "free" don't send an email to spam on their own. Keep one kind of content per email: no promotions in a receipt.
Where mail lands
Validity's 2025 figures, from test addresses: 87.2% of mail reached the inbox worldwide, 6.1% went to spam and 6.6% went missing. Gmail delivered 89.8% to the inbox, Yahoo 87.3%, and Microsoft 77.4%, the hardest of the big providers. Test addresses aren't real people's inboxes, so read these as the shape of the market.
The Promotions tab is part of the inbox. Gmail sorts marketing there; it isn't spam.
Doing it here
- Your campaigns go out from sending domains of their own, each with its SPF, DKIM and DMARC records written for you, so campaign traffic stays off your main domain: Sending domains, set up for you.
- There's no warm-up to run. Mail goes out at a natural pace for each mailbox provider from the first day: Do I need to warm up my sending domains?
- Every list is checked before anything sends, so typos, dead mailboxes, unsubscribes and spam reports are kept out: Why every list is cleaned.
- Bought or scraped lists aren't allowed: Can I upload a list I bought?
- Once 1,000 emails have gone out, a campaign pauses itself if 3 in every 100 bounce hard, and a version that draws spam reports is paused on its own: A campaign that protects itself.
- Every email carries the footer's unsubscribe link and the one-click headers, and an unsubscribe is honoured on every list: Unsubscribes, honoured everywhere.
- Your deliverability score rates out of 100 how much of your mail is getting through: Your deliverability score. If mail lands in spam, start here: My emails are landing in spam.
The rules, the thresholds and what to check when mail goes missing, drawn, are in the free guide Everything you need to know about email marketing.